Microsoft Sentinel low experimental kql

F&O - Reverted bank account number modifications

Identifies changes to bank account numbers in Finance & Operations, whereby a bank account number is modified but then subsequently reverted a short time later.

View Source

Detection Logic

let detection_window = 24h;
let query_frequency = 15m;
let bank_changes = FinanceOperationsActivity_CL
| where LogType == "Update" and TableName == "BankAccountTable"
| extend AccountId = tostring(parse_json(tostring(FormattedData.AccountID)).NewData)
| extend AccountNum = parse_json(tostring(FormattedData.AccountNum))
| extend
        CurrentAccountNum = tostring(AccountNum.NewData),
        OldAccountNum = tostring(AccountNum.OldData)
| where CurrentAccountNum != OldAccountNum;
bank_changes
| join kind=inner (bank_changes
| where TimeGenerated >= ago(query_frequency)
| project-rename UpdatedTime = LogCreatedDateTime, UpdatedAccount = CurrentAccountNum)
    on $left.OldAccountNum == $right.UpdatedAccount
| where UpdatedTime between (LogCreatedDateTime .. (LogCreatedDateTime + detection_window))
| extend FinOpsAppId = 32780
| project
    TimeGenerated,
    LogCreatedDateTime,
    LogType,
    TableName,
    Username,
    AccountId,
    CurrentAccountNum,
    OldAccountNum,
    FinOpsAppId

Field Validations

Loading…

Comments (0)

Loading comments...